⬢ DragonFlyBSD Kernel Audit
DF-5113 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5113",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ar5416PrepSpectralScan() (ar5416_spectral.c:75-81) runs ar5416DisableRadar() on every spectral configure/start/restore (:88, :193, :234); it maxes radar thresholds, clears AR_PHY_RADAR_0_ENA and AR_PHY_RADAR_EXT_ENA, and ORs bit 13 into AR_RX_FILTER (:47-73). ar5416StopSpectralScan() (:205-218) restores none of that state and the only in-tree re-enable path (ath_hal_enabledfs in ath_dfs/null/dfs_null.c:104-148) is #if 0d out. On DFS-enabled deployments of this HAL lineage this silently defeats radar detection after any spectral scan; in this DragonFly tree the null-DFS module makes radar detection non-operational anyway, so the impact is latent - filed as Info hardening. PoC skipped per contract: the audit guest has no AR9280/9285/9287 NIC (halSpectralScanSupport is AH_TRUE only on those; ar5416_attach.c:954), so ath_ioctl_spectral() returns EINVAL at if_ath_spectral.c:194-195 before this file is reached.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5113/VERDICT.md (path:line narrative); README.md; fix.diff (save/restore of AR_PHY_RADAR_0, AR_PHY_RADAR_EXT, AR_RX_FILTER in StopSpectralScan)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:47",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:63",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:70",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:88",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:193",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c:205",
    "sys/dev/netif/ath/ath_dfs/null/dfs_null.c:104",
    "sys/dev/netif/ath/ath/if_ath_spectral.c:194"
  ],
  "poc_changes": "No PoC authored - Info hardening finding with no in-tree manifestation (no AR928x NIC on guest; radar detection never enabled in-tree).",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 result for ar5416_spectral.c. The ss NULL-deref at :92/:143 is the sink of the already-filed DF-5070 chain (driver side) and is deliberately NOT re-reported. Driver-side param-copy bugs are DF-2079/DF-2080/DF-2081. Everything else in this file audited clean: SM()-masked register writes only (ah_internal.h:579), no division, no memory derefs except the ss pointer of the known chain; ar5416RestoreSpectralConfig/ar5416GetSpectralConfig are dead code (no ah_* slot, zero callers); no in-tree consumer of HAL_PHYERR_SPECTRAL samples.",
  "recommended_fix": "Save AR_PHY_RADAR_0/AR_PHY_RADAR_EXT/AR_RX_FILTER in ar5416PrepSpectralScan() and restore them in ar5416StopSpectralScan() - see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not_testable: fix validation requires AR928x hardware and an operational DFS stack; the guest has neither. Patch is compile-reviewed only.",
  "fix_evidence": "findings/poc/DF-5113/fix.diff"
}